KR20230000376A - Security monitoring intrusion detection alarm processing device and method using artificial intelligence - Google Patents

Abstract

The present invention relates to a security control intrusion detection alarm processing device using artificial intelligence and a method thereof, which automatically generate an exception rule based on payload content by applying a divide-and-conquer strategy to a security control event. The device comprises: a packet receiving part receiving a plurality of event packets; a packet classification part classifying the plurality of event packets in accordance with a prescribed criterion; a packet vectorizing part vectorizing classified event packets based on a payload of each packet to convert the event packets into packet vectors; a packet clustering part clustering the packet vectors to generate a plurality of clusters; a cluster labeling part inspecting the plurality of clusters to assign a label in accordance with a cluster property; and a rule generation part generating a detection rule for security control based on label information for the plurality of clusters.

Description

Security control intrusion detection alarm processing device and method using artificial intelligence

The present invention relates to artificial intelligence security control technology, and more particularly, to a security control intrusion detection alarm processing device using artificial intelligence that automatically creates an exception rule based on payload content by applying a divide and conquer strategy to a security control event, and It's about how.

For network security, it is necessary to capture network traffic and analyze the captured data to identify issues related to network traffic or possible malicious activity. In particular, among methods of analyzing data transmitted through network traffic, a method of collecting specific information of a file at a packet level and detecting a similar file through this may be used.

In addition, it is possible to perform security control on network traffic through security equipment, and for this purpose, security equipment can be installed in the user's network to check the security of transmitted packets.

On the other hand, IPS (Intrusion Prevention System) can generate security events through security rules created by the experience of security control personnel (experts). Since the periodic network usage pattern may be different for each network in which the IPS is installed, security rules may also be subjectively created. At this time, the security rule (or detection rule, exception rule) may correspond to a rule for detecting an attack pattern mainly from source, destination IP address, port number information or fundamental contents (payload) of an actual packet.

In addition, alarm fatigue in security control is a problem that has not been solved for a long time. Alarm fatigue may occur in the process of repeatedly generating security events when detection conditions are met according to set detection rules even for normal packets. A simple way to solve alarm fatigue is to force security events not to occur by making exceptions for frequently occurring events. However, this method may have problems such as the possibility of false negatives occurring in the future and manual work required when a new IP or event name appears.

Korean Patent Publication No. 10-2017-0091989 (2017.08.10)

An embodiment of the present invention is to provide a security control intrusion detection alarm processing apparatus and method using artificial intelligence that automatically creates an exception rule based on payload contents by applying a divide and conquer strategy to a security control event.

An embodiment of the present invention is a security control intrusion detection alarm processing device using artificial intelligence that groups the same or very similar events based on payload content in addition to IP and event name and sets detection rules for security control according to group characteristics And to provide a method.

Among the embodiments, an apparatus for processing an intrusion detection alarm for security control using artificial intelligence includes a packet receiving unit for receiving a plurality of event packets; a packet classification unit to classify the plurality of event packets according to a predetermined criterion; a packet vectorization unit which vectorizes the classified event packets based on the payload of each packet and converts them into packet vectors; a packet clustering unit generating a plurality of clusters by clustering the packet vectors; a cluster labeling unit for examining each of the plurality of clusters and assigning a label according to cluster characteristics; and a rule generating unit generating a detection rule for security monitoring based on the label information of the plurality of clusters.

Each of the plurality of event packets includes a time (t), a source address (sip), a destination address (dip), a source port (sp), a destination port (dp), an event name (en), and the payload (p). can include

The packet classification unit may classify the plurality of event packets based on an event packet address and an event name.

The packet vectorizer divides the payload into a plurality of tokens or chunks and applies a vectorization technique including a TF-IDF algorithm, a COUNT algorithm, and a feature hashing (FH) algorithm By doing so, the packet vectors can be generated.

The packet vectorizer may limit the size of the packet vectors to a predetermined vector size.

The packet clustering unit may generate the plurality of clusters based on similarity of distances between the packet vectors.

The cluster labeling unit may sample packet vectors in a cluster for each of the plurality of clusters and determine cluster characteristics of the corresponding cluster according to a result of analyzing whether or not there is an anomaly.

The cluster labeling unit may determine a characteristic corresponding to a majority distribution as the cluster characteristic as a result of analyzing the sampled packet vectors.

The rule generation unit may add the corresponding specific cluster to the white list for security monitoring if the cluster characteristics are normal, and if not, add the corresponding specific cluster to the black list for security monitoring.

The apparatus may further include a security monitoring unit configured to perform security monitoring on event packets received from the outside based on the detection rule and generate an alarm for intrusion detection.

Among the embodiments, a security control intrusion detection alarm processing method using artificial intelligence includes receiving a plurality of event packets; classifying the plurality of event packets according to a predetermined criterion; vectorizing the classified event packets based on the payload of each packet and converting them into packet vectors; generating a plurality of clusters by clustering the packet vectors; examining each of the plurality of clusters and assigning a label according to cluster characteristics; generating a detection rule for security monitoring based on label information on the plurality of clusters; and performing security control on an event packet received from the outside based on the detection rule and generating an alarm for intrusion detection.

The converting into packet vectors divides the payload into a plurality of tokens or a plurality of chunks and includes a TF-IDF algorithm, a COUNT algorithm and a feature hashing (FH) algorithm and generating the packet vectors by applying a vectorization technique of

The generating of the plurality of clusters may include generating the plurality of clusters based on similarity of distances between the packet vectors.

The assigning of the label may include sampling packet vectors within the cluster for each of the plurality of clusters and determining a cluster characteristic of the corresponding cluster according to a result of analyzing whether or not there is an anomaly.

The generating of the detection rule includes adding the corresponding specific cluster to the white list for security monitoring if the cluster characteristics are normal, and adding the corresponding specific cluster to the black list for security monitoring if not. can do.

The disclosed technology may have the following effects. However, it does not mean that a specific embodiment must include all of the following effects or only the following effects, so it should not be understood that the scope of rights of the disclosed technology is limited thereby.

An apparatus and method for processing a security control intrusion detection alarm using artificial intelligence according to an embodiment of the present invention apply a divide and conquer strategy to a security control event to automatically generate exception rules based on payload contents.

Security control intrusion detection alarm processing apparatus and method using artificial intelligence according to an embodiment of the present invention groups the same or very similar events based on payload content in addition to IP and event name, and detects for security control according to group characteristics You can set rules.

1 is a diagram illustrating an alarm processing system according to the present invention.
FIG. 2 is a diagram explaining the system configuration of the alarm processing device of FIG. 1 .
FIG. 3 is a diagram explaining the functional configuration of the alarm processing device of FIG. 1 .
4 is a flowchart illustrating an alarm processing process according to the present invention.
5 is a diagram illustrating a relationship between an alarm processing method according to the present invention and an alarm fatigue problem.
6 is a diagram explaining a security control intrusion detection alarm processing method using artificial intelligence according to the present invention.
7 is a diagram explaining the experimental results of the security control intrusion detection alarm processing method using artificial intelligence according to the present invention.

Since the description of the present invention is only an embodiment for structural or functional description, the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, since the embodiment can be changed in various ways and can have various forms, it should be understood that the scope of the present invention includes equivalents capable of realizing the technical idea. In addition, since the object or effect presented in the present invention does not mean that a specific embodiment should include all of them or only such effects, the scope of the present invention should not be construed as being limited thereto.

Meanwhile, the meaning of terms described in this application should be understood as follows.

Terms such as "first" and "second" are used to distinguish one component from another, and the scope of rights should not be limited by these terms. For example, a first element may be termed a second element, and similarly, a second element may be termed a first element.

It should be understood that when an element is referred to as being “connected” to another element, it may be directly connected to the other element, but other elements may exist in the middle. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that no intervening elements exist. Meanwhile, other expressions describing the relationship between components, such as “between” and “immediately between” or “adjacent to” and “directly adjacent to” should be interpreted similarly.

Expressions in the singular number should be understood to include plural expressions unless the context clearly dictates otherwise, and terms such as “comprise” or “having” refer to an embodied feature, number, step, operation, component, part, or these. It should be understood that it is intended to indicate that a combination exists, and does not preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

In each step, the identification code (eg, a, b, c, etc.) is used for convenience of explanation, and the identification code does not describe the order of each step, and each step clearly follows a specific order in context. Unless otherwise specified, it may occur in a different order than specified. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The present invention can be implemented as computer readable code on a computer readable recording medium, and the computer readable recording medium includes all types of recording devices storing data that can be read by a computer system. . Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage devices. In addition, the computer-readable recording medium may be distributed to computer systems connected through a network, so that computer-readable codes may be stored and executed in a distributed manner.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs, unless defined otherwise. Terms defined in commonly used dictionaries should be interpreted as consistent with meanings in the context of the related art, and cannot be interpreted as having ideal or excessively formal meanings unless explicitly defined in the present application.

1 is a diagram illustrating an alarm processing system according to the present invention.

Referring to FIG. 1 , the alarm processing system 100 may include a user terminal 110 , an alarm processing device 130 and a database 150 .

The user terminal 110 may correspond to a computing device capable of transmitting data and using various services using a network, and may be implemented as a smartphone, laptop, or computer, but is not necessarily limited thereto, and various devices such as a tablet PC. can also be implemented. The user terminal 110 may be connected to the alarm processing device 130 through a network, and a plurality of user terminals 110 may be simultaneously connected to the alarm processing device 130 .

The alarm processing device 130 monitors the network status in the process of data communication between the user terminals 110 or connection to an external system and uses the network, detects security events, security intrusions such as malicious codes, generates alarms, and secures security. It may be implemented as a server corresponding to a computer or program capable of executing actions. The alarm processing device 130 may be connected to the user terminal 110 through a network and exchange information. In one embodiment, the alarm processing device 130 may store data necessary for network monitoring and security control in conjunction with the database 150 .

The database 150 may correspond to a storage device for storing various pieces of information necessary for the operation of the alarm processing device 130 . The database 150 may store packet information collected during the network monitoring process, and may store various rules for intrusion detection and information related to artificial intelligence learning, but is not limited thereto, and the alarm processing device 130 may store In the process of automatically generating detection rules for intrusion detection based on the contents of packet payloads and applying them to security control, collected or processed information can be stored in various forms.

FIG. 2 is a diagram explaining the system configuration of the alarm processing device of FIG. 1 .

Referring to FIG. 2 , the alarm processing device 130 may include a processor 210, a memory 230, a user input/output unit 250, and a network input/output unit 270.

The processor 210 may execute a procedure for processing each step in the operation of the alarm processing device 130, manage the memory 230 read or written throughout the process, and may manage the memory 230. ), you can schedule the synchronization time between volatile memory and non-volatile memory. The processor 210 can control the overall operation of the alarm processing device 130, and is electrically connected to the memory 230, the user input/output unit 250, and the network input/output unit 270 to control data flow between them. can The processor 210 may be implemented as a central processing unit (CPU) of the alarm processing device 130 .

The memory 230 may include an auxiliary storage device implemented as a non-volatile memory such as a solid state drive (SSD) or a hard disk drive (HDD) and used to store all data necessary for the alarm processing device 130, It may include a main memory implemented as a volatile memory such as RAM (Random Access Memory).

The user input/output unit 250 may include an environment for receiving user input and an environment for outputting specific information to the user. For example, the user input/output unit 250 may include an input device including an adapter such as a touch pad, a touch screen, an on-screen keyboard, or a pointing device, and an output device including an adapter such as a monitor or touch screen. In one embodiment, the user input/output unit 250 may correspond to a computing device connected through a remote connection, and in such a case, the alarm processing device 130 may be implemented as an independent server.

The network input/output unit 270 includes an environment for connecting to an external device or system through a network, and includes, for example, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), and a VAN ( An adapter for communication such as Value Added Network) may be included.

FIG. 3 is a diagram explaining the functional configuration of the alarm processing device of FIG. 1 .

Referring to FIG. 3 , the alarm processing device 130 includes a packet reception unit 310, a packet classification unit 320, a packet vectorization unit 330, a packet clustering unit 340, a cluster labeling unit 350, and a rule generation unit. 360, a security control performing unit 370, and a control unit (not shown in FIG. 3) may be included.

The packet receiving unit 310 may receive a plurality of event packets. Here, each of the plurality of event packets includes time (t), source address (sip), destination address (dip), source port (sp), destination port (dp), event name (en), and payload (p). can include That is, an event packet may correspond to a formatted block of data transmitted over a network and may include a packet header and a payload. The packet header may include time (t), source address (sip), destination address (dip), source port (sp), destination port (dp), event name (en), and the like. A plurality of event packets may be received from the outside of the alarm processing device 130 through a network, and the alarm processing device 130 may copy (tap) event packets passing through a router on an intrusion detection system or a security control system. ) to collect event packets for intrusion detection.

The packet classification unit 320 may classify a plurality of event packets according to a predetermined criterion. That is, the packet classification unit 320 may determine at least one of a variety of pieces of information included in the event packet as a criterion for classification and perform a packet classification operation. In one embodiment, the packet classification unit 320 may classify a plurality of event packets based on the event packet address and event name.

For example, the packet classification unit 320 may classify event packets through a predetermined classifier. The IETS (Internal/External, Terminal/Server) classifier can classify event packets into internal or external, terminal or server based on the IP address of the event packet. Event packets classified by the IETS classifier may be included in sets classified into internal servers, internal terminals, external servers, and external terminals, respectively. Also, the packet classification unit 320 may classify event packets through an object identifier. An object identifier may classify event packets based on event names. As a result, the packet classification unit 320 may generate a plurality of event packet sets by sequentially classifying event packets based on IP and name.

The packet vectorization unit 330 may vectorize the classified event packets based on the payload of each packet and convert them into packet vectors. The payload of the packet may include control information and user data, and may have various lengths according to information stored in the payload. That is, the packet vectorizer 330 may obtain characteristic information about the main content of the packet by vectorizing the payload of the packet.

In one embodiment, the packet vectorizer 330 divides the payload into a plurality of tokens or chunks and uses a TF-IDF algorithm, a COUNT algorithm, and a feature hashing (FH) algorithm. Packet vectors may be generated by applying a vectorization technique including Since the length of the payload varies, the packet vectorizer 330 can divide the payload into predetermined unit elements, and a series of streams can be formed according to the payload division. The packet vectorizer 330 may divide the payload using various division algorithms. For example, the packet vectorizer 330 may divide the payload into a plurality of tokens using a text-based tokenizer, and divide the payload into a plurality of chunks through content-based chunking (CBC). can

In addition, the packet vectorizer 330 may generate a packet vector by matching each of a plurality of tokens or a plurality of chunks to a component of the vector, using a TF-IDF algorithm, a COUNT algorithm, and a feature hashing algorithm. You can also create a packet vector using For example, when packet p1 = “a bb c”, it may be converted into packet vector v1 = (a, bb, c) corresponding to packet p1. In addition, when packet p2 = “%7#bb”, it may be converted into packet vector v2 = (%7#, c, bb) corresponding to packet p2. In addition, when packet p3 = “a1bbc@c”, it may be converted to packet v3 = (a1, bb, c@c) corresponding to packet p3.

In one embodiment, the packet vectorizer 330 may limit the size of packet vectors to a predetermined vector size. The packet vectorizer 330 may apply a predetermined vector size to the packet vectors in order to perform a clustering operation on the packet vectors in a later step. That is, packet vectors generated based on each payload may be generated within a vector size.

The packet clustering unit 340 may generate a plurality of clusters by clustering packet vectors. The packet clustering unit 340 may utilize various clustering algorithms to classify vectors having similar characteristics among packet vectors into one cluster. Meanwhile, the vector size of the packet vectors generated in the previous step may be determined according to the clustering algorithm used by the packet clustering unit 340 .

In an embodiment, the packet clustering unit 340 may generate a plurality of clusters based on similarity of distances between packet vectors. For example, the packet clustering unit 340 may cluster packet vectors using a dbscan algorithm. Here, the dbscan algorithm is a density-based clustering technique, and when there are more than a minimum number of points (minPts) within a specific radius (epsilon) based on a specific core point, the corresponding points are generated as one cluster. can do. That is, when the distance between the packet vectors is within a predetermined distance, the packet clustering unit 340 may determine that there is a similarity between the corresponding packet vectors and group them into the same cluster.

The cluster labeling unit 350 may inspect each of the plurality of clusters and assign a label according to the characteristics of the cluster. Here, the cluster characteristics may correspond to feature information common between packet vectors existing in the cluster or feature information distributed over a plurality of packet vectors in the cluster. The cluster labeling unit 350 may derive cluster characteristics for each cluster and determine a label for the corresponding cluster.

In an embodiment, the cluster labeling unit 350 may sample packet vectors within a cluster for each of a plurality of clusters and determine cluster characteristics of the corresponding cluster according to a result of analyzing whether or not there is an anomaly. The cluster labeling unit 350 may inspect all packet vectors present in a specific cluster to determine cluster characteristics, but after extracting only predetermined packet vectors through sampling, the cluster characteristics are determined based on common characteristics of the corresponding packet vectors. can be estimated The cluster labeling unit 350 may randomly sample packet vectors by a predetermined number for each cluster, and is not necessarily limited thereto, and various sampling techniques may be applied.

In an embodiment, the cluster labeling unit 350 may determine a characteristic corresponding to a majority distribution as a cluster characteristic as a result of analyzing the sampled packet vectors. For example, the cluster characteristics may be determined based on an abnormal distribution or a normal distribution of sampled packet vectors, and accordingly may be determined as benign or malicious. As another example, the cluster characteristics may be determined based on the distribution of FP (False Positive), TP (True Positive), FN (False Negative), and TN (True Negative) related to malware detection, and accordingly, FP only, It can be determined as TP+FP, TP only, etc.

The rule generator 360 may generate a detection rule for security monitoring based on label information on a plurality of clusters. That is, detection rules may be generated based on information about clusters and label information for each cluster. The rule generator 360 may periodically generate or update a detection rule through cluster analysis of event packets. For example, in security control and intrusion detection, detection rules may be composed of a blacklist and a whitelist for detecting abnormal situations.

In an embodiment, the rule generation unit 360 adds the specific cluster to a whitelist for security control if the cluster characteristics are normal, and if not, adds the specific cluster to a blacklist for security control. can be added to For example, when a cluster characteristic is classified as malicious, the rule generating unit 360 may add the corresponding cluster and packet vectors to a white list. If the cluster characteristics are classified as normal, the rule generating unit 360 may add the corresponding cluster and packet vectors to the black list.

The security monitoring unit 370 may perform security monitoring on event packets received from the outside based on detection rules and generate an alarm for intrusion detection. More specifically, the security control performing unit 370 may perform security control on event packets that pass through a router from the outside using a detection rule. The security control performing unit 370 may extract a payload from the event packet, generate a packet vector corresponding to the payload, and classify the packet vector to match one of the previously created clusters. can If the matched cluster is included in the blacklist, the security control execution unit 370 may generate an alarm for the corresponding event packet and deliver it to a manager or transmit it to a control server. Also, the security monitoring unit 370 may perform a security monitoring operation according to whether the packet vector itself is included in the blacklist or whitelist.

A controller (not shown in FIG. 3) controls the overall operation of the alarm processing device 130, and includes a packet receiving unit 310, a packet classification unit 320, a packet vectorization unit 330, a packet clustering unit 340, Control flow or data flow between the cluster labeling unit 350 , the rule generation unit 360 and the security control execution unit 370 may be managed.

4 is a flowchart illustrating an alarm processing process according to the present invention.

Referring to FIG. 4 , the alarm processing device 130 may receive a plurality of event packets through the packet receiver 310 (step S410). The alarm processing device 130 may classify a plurality of event packets according to a predetermined criterion through the packet classification unit 320 (step S420). The alarm processing device 130 may vectorize the event packets classified through the packet vectorization unit 330 based on the payload of each packet and convert them into packet vectors (step S430).

In addition, the alarm processing device 130 may generate a plurality of clusters by clustering the packet vectors through the packet clustering unit 340 (step S440). The alarm processing device 130 may inspect each of the plurality of clusters through the cluster labeling unit 350 and assign a label according to the characteristics of the cluster (step S450). The alarm processing device 130 may generate a detection rule for security monitoring based on label information on a plurality of clusters through the rule generator 360 (step S460).

5 is a diagram illustrating a relationship between an alarm processing method according to the present invention and an alarm fatigue problem.

Referring to FIG. 5 , the alarm processing device 130 may perform a method for solving an alarm fatigue problem while increasing a security level. In the conventional case, both FALSE POSITIVE and TRUE POSITIVE showed high detection performance for event packets, and responses were made in the direction of lowering FALSE POSITIVE through manual settings such as analyzing a predetermined event and setting detection exclusion rules. However, in this case, a problem may occur in which TRUE POSITIVE is lowered together with FALSE POSITIVE according to the collective application of detection exclusion rules. The alarm processing device 130 may improve this and perform an alarm processing method in which FALSE POSITIVE is lowered while TRUE POSITIVE is maintained higher than before.

6 is a diagram explaining a security control intrusion detection alarm processing method using artificial intelligence according to the present invention.

Referring to FIGS. 6A and 6B , the alarm processing device 130 may perform security control by examining event packets coming from the outside. In particular, the alarm processing device 130 may classify and group event packets according to a predetermined criterion (Grouping), and analyze payloads of the grouped event packets to generate packet vectors reflecting payload contents. (Vectorization).

In addition, the alarm processing apparatus 130 may perform clustering based on similarity between vectors based on packet vectors (Clustering), and may assign a label according to each characteristic to the clustered clusters (Sampling). & Analysis). The alarm processing device 130 may generate rules for security control and intrusion detection based on the characteristic information and label information of the clusters, and may specifically create a whitelist and a blacklist (Rule generation). The alarm processing device 130 may perform security control by monitoring event packets by utilizing the whitelist and the blacklist.

7 is a diagram explaining the experimental results of the security control intrusion detection alarm processing method using artificial intelligence according to the present invention.

Referring to FIG. 7 , based on KISTI data and WINS data, experimental data related to the security control intrusion detection alarm processing method using artificial intelligence according to the present invention can be obtained. Since KISTI data has labels, it is possible to evaluate performance and can be used as training data and test data, respectively. Wins data may correspond to data for which a label does not exist.

As a result of performing clustering on a total of 8759 event packets through the alarm processing method according to the present invention, 24 clusters and other packet sets (Remain_25) can be generated. Accordingly, the alarm processing method according to the present invention performs comparison with each cluster targeting a specific event packet and with packets of other packet sets, and completes the detection operation for the specific event packet with a total of 74 comparisons. can do. In particular, each of the 24 clusters generated through clustering may include event packets classified as normal (Ben) or malicious (Mal), and feature information showing a majority distribution in each cluster may be determined as a cluster characteristic of the corresponding cluster. can

The alarm processing method according to the present invention can automatically generate detection rules for intrusion detection through analysis of event packets, and can perform security control operations by applying the generated detection rules. In particular, clustering of event packets is performed based on the result of analyzing the payload containing the main contents of the event packet, and common feature information is established in advance, thereby effectively performing surveillance operations for intrusion detection.

Although the above has been described with reference to preferred embodiments of the present invention, those skilled in the art will variously modify and change the present invention within the scope not departing from the spirit and scope of the present invention described in the claims below. You will understand that it can be done.

100: alarm processing system
110: user terminal 130: alarm processing device
150: database
210: processor 230: memory
250: user input/output unit 270: network input/output unit
310: packet receiving unit 320: packet classification unit
330: packet vectorization unit 340: packet clustering unit
350: cluster labeling 360: rule generator
370: security control department

Claims (15)

a packet receiving unit receiving a plurality of event packets;
a packet classification unit to classify the plurality of event packets according to a predetermined criterion;
a packet vectorization unit which vectorizes the classified event packets based on the payload of each packet and converts them into packet vectors;
a packet clustering unit generating a plurality of clusters by clustering the packet vectors;
a cluster labeling unit for examining each of the plurality of clusters and assigning a label according to cluster characteristics; and
A security control intrusion detection alarm processing device using artificial intelligence comprising: a rule generator for generating a detection rule for security control based on the label information for the plurality of clusters.
The method of claim 1, wherein each of the plurality of event packets
Artificial intelligence characterized in that it includes time (t), departure address (sip), destination address (dip), departure port (sp), arrival port (dp), event name (en), and the payload (p) Security control intrusion detection alarm processing device using.
The method of claim 1, wherein the packet classification unit
A security control intrusion detection alarm processing device using artificial intelligence, characterized in that for classifying the plurality of event packets based on the address and event name of the event packet.
The method of claim 1, wherein the packet vectorizer
The packet vector by dividing the payload into a plurality of tokens or a plurality of chunks and applying a vectorization technique including a TF-IDF algorithm, a COUNT algorithm, and a feature hashing (FH) algorithm Security control intrusion detection alarm processing device using artificial intelligence, characterized in that for generating.
5. The method of claim 4, wherein the packet vectorization unit
An intrusion detection alarm processing device for security control using artificial intelligence, characterized in that for limiting the size of the packet vectors to a predetermined vector size.
The method of claim 1, wherein the packet clustering unit
The security control intrusion detection alarm processing device using artificial intelligence, characterized in that for generating the plurality of clusters based on the similarity of the distance between the packet vectors.
The method of claim 1, wherein the cluster labeling unit
A security control intrusion detection alarm processing device using artificial intelligence, characterized in that for each of the plurality of clusters, packet vectors in the cluster are sampled and a cluster characteristic of the corresponding cluster is determined according to a result of analyzing whether or not there is an anomaly.
The method of claim 7, wherein the cluster labeling unit
As a result of analysis of the sampled packet vectors, a characteristic corresponding to a majority distribution is determined as the cluster characteristic.
The method of claim 1, wherein the rule generator
If the cluster characteristics are normal, the specific cluster is added to the white list for security control, and if not, the specific cluster is added to the black list for security control. Detection alarm processing unit.
According to claim 1,
Security control intrusion detection alarm processing using artificial intelligence; further comprising a security control execution unit for performing security control on event packets received from outside based on the detection rule and generating an alarm related to intrusion detection. Device.
receiving a plurality of event packets;
classifying the plurality of event packets according to a predetermined criterion;
vectorizing the classified event packets based on the payload of each packet and converting them into packet vectors;
generating a plurality of clusters by clustering the packet vectors;
examining each of the plurality of clusters and assigning a label according to cluster characteristics;
generating a detection rule for security monitoring based on label information on the plurality of clusters; and
A security control intrusion detection alarm processing method using artificial intelligence comprising: performing security control on event packets received from the outside based on the detection rule and generating an alarm related to intrusion detection.
12. The method of claim 11, wherein the converting to packet vectors comprises:
The packet vector by dividing the payload into a plurality of tokens or a plurality of chunks and applying a vectorization technique including a TF-IDF algorithm, a COUNT algorithm, and a feature hashing (FH) algorithm Security control intrusion detection alarm processing method using artificial intelligence, characterized in that it comprises the step of generating.
12. The method of claim 11, wherein generating a plurality of clusters
The security control intrusion detection alarm processing method using artificial intelligence, characterized in that it comprises generating the plurality of clusters based on the similarity of the distance between the packet vectors.
12. The method of claim 11, wherein the step of assigning the label
A security control intrusion detection alarm processing method using artificial intelligence comprising the step of sampling packet vectors in a cluster for each of the plurality of clusters and determining a cluster characteristic of the corresponding cluster according to a result of analyzing whether there is an anomaly or not. .
12. The method of claim 11, wherein generating the detection rule
If the cluster characteristics are normal, adding the specific cluster to the white list for security control, and if not, adding the specific cluster to the black list for security control. Security control intrusion detection alarm handling method.

Images